The most uncomfortable part of FinCEN’s consent order is not the technology. It is the story of what happened when the bank’s own compliance staff concluded that two high-revenue customers were too risky, and the business pushed back. FinCEN uses this history to support its findings on customer due diligence, to establish that management knew of the problem, and to explain why it weighted financial...

The core of FinCEN’s case against Bank of America is a single system. The bank’s proprietary transaction monitoring platform, called Event Processor (EP), was its primary control for identifying and reporting suspicious activity. FinCEN’s consent order describes, in unusual detail, how that system was built, what the bank’s own testing said about it, and why the problems persisted for years. For compliance officers, it is...

On October 13, 2026, the Treasury Department announced what it called the third-largest penalty in its history. Three bureaus, FinCEN, the OCC, and OFAC, resolved overlapping investigations of Bank of America, N.A., the second-largest bank in the United States, in a single coordinated announcement. The headline number is more than $1.21 billion. The structure behind that number, and the admissions attached to it, matter at...

If your sanctions program is still the 2019 version, it’s missing the last seven years of enforcement. OFAC’s 2019 framework is still your foundation: management commitment, risk assessment, internal controls, testing, and training. But DOJ, Commerce, and Treasury have layered new expectations on top of that through joint Tri-Seal Notes. Four of them should be on your list today. One, U.S. nexus now reaches foreign...

The Adani prosecution has become one of the most closely watched corruption cases in the country, and not because of the facts alleged in the indictment. It is now a contest over a narrower and more consequential question: when the Justice Department decides it no longer wants to pursue a criminal case, how much of an explanation does a federal court get to demand? On...

AI is not coming to your company. It is already there. Employees are drafting emails, summarizing contracts, writing code and analyzing data with AI tools today, many on personal accounts the company never approved. If your organization does not have a responsible AI use policy, you do not have an AI strategy. You have an AI exposure. The Risk Is Not Theoretical The warning signs...

For years, a healthcare company that discovered possible wrongdoing faced two questions at once: should we tell the government, and which part of the government should hear it first? On October 15, 2026, the Justice Department’s National Fraud Enforcement Division and the Department of Health and Human Services Office of Inspector General answered the second question with a joint Policy on Coordination of Voluntary Self-Disclosure...

In this episode of Corruption, Crime and Compliance, Michael Volkov examines the more than $1.21 billion in Treasury penalties announced October 13, 2026 against Bank of America, including FinCEN’s $1.2 billion consent order, which credits the OCC’s record $750 million penalty and includes the bank’s admission that it willfully violated the Bank Secrecy Act. Volkov explains how the bank’s homegrown transaction monitoring system, Event Processor,...

In this episode of Corruption, Crime and Compliance, Michael Volkov examines OFAC’s October 9, 2026 settlement with Pegasus Worldwide Logistics, a small California freight forwarder that agreed to pay $175,015 for apparent violations of counter narcotics sanctions and OFAC reporting obligations. Pegasus arranged the shipment of a $5,950 sugar packet-filling machine from a China-based supplier that had been designated, but had changed its name while...

Compliance used to count training completions. Today, regulators want proof your program actually works. That shift didn’t happen by accident. Twenty years ago, compliance data meant hotline calls and a training checklist. The numbers were easy to collect and nearly impossible to interpret. A quiet hotline could mean a great culture or a terrified workforce. Then regulators started asking harder questions: Do you track your...